The paradox is that if the models are restricted, more exposed software will exist. I'm not convinced you can make a model that allows you to build secure software without it also being able to build exploits.